registry / wp-studio / 1.15.0

wp-studio@1.15.0

WordPress Studio CLI

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 22 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

Manifest

CopyleftLicense

scanned 1,268 file(s), 40.7 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.wordpress.org, appscdn.wordpress.com, assets-cdn.github.com, assets.zyrosite.com, automattic.com, base-ui.com, bit.ly, bugs.jquery.com, cdn.dashjs.org, cdn.jsdelivr.net, davidwalsh.name, dev.ean.com, dev.mysql.com, developer.mozilla.org, developer.wordpress.com, developer.wordpress.org, docs.jquery.com, dom.spec.whatwg.org, domain.com, ecma-international.org, eev.ee, en.wikipedia.org, example.com, fb.me, fonts.gstatic.com, get.adobe.com, github.com, gitlab.com, gravatar.com, img.youtube.com, jquery.org, jqueryvalidation.org, json-schema.org, lodash.com, mathiasbynens.be, mercantile.wordpress.org, momentjs.com, my-site-replica.wp.local, nodejs.org, npms.io, openlayers.org, placeholder.invalid, player.vimeo.com, popper.js.org, public-api.wordpress.com, purl.org, radix-ui.com, raw.githubusercontent.com

Oversized source lightweight scan

dist/cli/admin-credentials-CxvNpb5L.mjs3.15 MB file, sampled 256 KB

FilesystemHighEntropyStringsUrlStringsappscdn.wordpress.comgithub.comnodejs.orgwordpress.com

dist/cli/data-liberation-agent/dist/mcp-server.bundle.mjs3.55 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsMinifiedProtestware

dist/cli/wp-files/latest/wordpress/wp-includes/js/dist/block-editor.js2.70 MB file, sampled 256 KB

FilesystemChildProcessObfuscatedHighEntropyStringsUrlStringsfb.me

dist/cli/wp-files/latest/wordpress/wp-includes/js/dist/block-library.js2.57 MB file, sampled 256 KB

ChildProcessHighEntropyStringsUrlStringsdom.spec.whatwg.orggithub.comschemas.wp.orgupload.wikimedia.orgwww.w3.org

dist/cli/wp-files/latest/wordpress/wp-includes/js/dist/components.js3.83 MB file, sampled 256 KB

ChildProcessHighEntropyStringsUrlStringswww.w3.org

dist/cli/wp-files/latest/wordpress/wp-includes/js/dist/editor.js2.50 MB file, sampled 256 KB

ChildProcessHighEntropyStringsUrlStringsfb.mes.w.orgwordpress.orgwww.w3.org

Source & flagged code

10 flagged

dist/cli/wp-files/latest/wordpress/wp-admin/js/auth-app.jsView file

Lines 64-104javascript

64 *

65 * In most cases, this should be used in combination with the {@see 'wp_authorize_application_password_form_approved_no_js'}

66 * action to ensure that both the JS and no-JS variants are handled.

67 *

68 * @since 5.6.0

69 *

70 * @param {Object} response The response from the REST API.

71 * @param {string} response.password The newly created password.

72 * @param {string} textStatus The status of the request.

73 * @param {jqXHR} jqXHR The underlying jqXHR object that made the request.

74 */

75 wp.hooks.doAction( 'wp_application_passwords_approve_app_request_success', response, textStatus, jqXHR );

77 var raw = authApp.success,

78 url, message, $notice;

80 if ( raw ) {

81 url = raw + ( -1 === raw.indexOf( '?' ) ? '?' : '&' ) +

82 'site_url=' + encodeURIComponent( authApp.site_url ) +

83 '&user_login=' + encodeURIComponent( authApp.user_login ) +

84 '&password=' + encodeURIComponent( response.password );

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli/wp-files/latest/wordpress/wp-admin/js/auth-app.jsView on unpkg · L84

86 window.location = url;

87 } else {

88 message = wp.i18n.sprintf(

89 /* translators: %s: Application name. */

90 '<label for="new-application-password-value">' + wp.i18n.__( 'Your new password for %s is:' ) + '</label>',

91 '<strong></strong>'

92 ) + ' <input id="new-application-password-value" type="text" class="code" readonly="readonly" value="" />';

93 $notice = $( '<div></div>' )

94 .attr( 'role', 'alert' )

95 .attr( 'tabindex', -1 )

96 .addClass( 'notice notice-success notice-alt' )

97 .append( $( '<p></p>' ).addClass( 'application-password-display' ).html( message ) )

98 .append( '<p>' + wp.i18n.__( 'Be sure to save this in a safe location. You will not be able to retrieve it.' ) + '</p>' );

100 // We're using .text() to write the variables to avoid any chance of XSS.

101 $( 'strong', $notice ).text( response.name );

102 $( 'input', $notice ).val( response.password );

103

104 $form.replaceWith( $notice );

dist/cli/wp-files/phpmyadmin/js/dist/functions.jsView file

Lines 3438-3478javascript

3438 addClass = 'off';

3439 } else {

3440 if (right === 'right') {

3441 operator = '+=';

3442 } else {

3443 operator = '-=';

dist/cli/wp-files/phpmyadmin/js/dist/ol.jsView file

Lines 1-26javascript

1"use strict";

3Object.defineProperty(exports, "__esModule", {

4 value: true

5});

6exports.default = void 0;

7var _control = require("ol/control.js"

dist/cli/data-liberation-agent/dist/lib/replicate/local-data/scaffold-model.jsView file

Lines 1-21javascript

1import { runInNewContext } from 'node:vm';

2import { DATA_MODEL_SCHEMA } from './types.js';

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/cli/data-liberation-agent/dist/lib/replicate/local-data/scaffold-model.jsView on unpkg · L1

3import { validateDataModel } from './validate-model.js';

4import { discoverHtmlCards }

dist/cli/data-liberation-agent/dist/lib/replicate/parity/parity-classify.jsView file

Lines 1-21javascript

1// src/lib/replicate/parity/parity-classify.ts

2//

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/data-liberation-agent/dist/lib/replicate/parity/parity-classify.jsView on unpkg · L1

3// The divergence catalog as code — the deterministic heart of the repair

4// loop. Ordered rules; first match wins; anything not provably patchable is

5// REPORTED, never guessed (determinism directive: AI/manual is a separate,

6// opt-in escalation). Patch css is byte-stable: sorted, marker-wrapped, no

7// timestamps.

8//

dist/cli/wp-files/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavusansb.zView file

•path = dist/cli/wp-[redacted].z kind = high_entropy_blob sizeBytes = 347269 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/cli/wp-files/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavusansb.zView on unpkg

dist/cli/wp-files/latest/wordpress/wp-includes/js/dist/editor.jsView file

•path = dist/cli/wp-files/latest/wordpress/wp-includes/js/dist/editor.js kind = oversized_source_file sizeBytes = 2617702 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli/wp-files/latest/wordpress/wp-includes/js/dist/editor.jsView on unpkg

dist/cli/config-BRpv2qyH.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = wp-studio@1.13.0 matchedIdentity = npm:d3Atc3R1ZGlv:1.13.0 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/config-BRpv2qyH.mjsView on unpkg

dist/cli/wp-files/phpmyadmin/js/vendor/zxcvbn-ts.jsView file

Lines 1897-1937javascript

1897 };

1898 const crackTimesDisplay = {

1899 onlineThrottling100PerHour: '',

1900 onlineNoThrottling10PerSecond: '',

1901 offlineSlowHashing1e4PerSecond: '',

1902 offlineFastHashing1e10PerSecond: ''

1903 };

1904 Object.

dist/cli/wp-files/latest/wordpress/wp-admin/js/auth-app.min.jsView file

Lines 1-2javascript

1/*! This file is auto-generated */

2!function(t,s){var p=t("#app_name"),r=t("#approve"),e=t("#reject"),n=p.closest("form"),i={userLogin:s.user_login,successUrl:s.success,rejectUrl:s.reject};r.on("click",

Source & flagged code

10 flagged · loading source

dist/cli/wp-files/latest/wordpress/wp-admin/js/auth-app.jsView file

84patternName = generic_password severity = medium line = 84 matchedText = '&passwo...d );

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli/wp-files/latest/wordpress/wp-admin/js/auth-app.jsView on unpkg · L84

dist/cli/wp-files/phpmyadmin/js/dist/functions.jsView file

3458// eslint-disable-next-line no-eval L3459: eval(callback); L3460: } else {

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/cli/wp-files/phpmyadmin/js/dist/functions.jsView on unpkg · L3458

dist/cli/wp-files/phpmyadmin/js/dist/ol.jsView file

6exports.default = void 0; L7: var _control = require("ol/control.js"); L8: var _coordinate = require("ol/coordinate.js");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/wp-files/phpmyadmin/js/dist/ol.jsView on unpkg · L6

dist/cli/data-liberation-agent/dist/lib/replicate/local-data/scaffold-model.jsView file

1import { runInNewContext } from 'node:vm'; L2: import { DATA_MODEL_SCHEMA } from './types.js';

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/cli/data-liberation-agent/dist/lib/replicate/local-data/scaffold-model.jsView on unpkg · L1

dist/cli/data-liberation-agent/dist/lib/replicate/parity/parity-classify.jsView file

1// src/lib/replicate/parity/parity-classify.ts L2: //

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/data-liberation-agent/dist/lib/replicate/parity/parity-classify.jsView on unpkg · L1

dist/cli/wp-files/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavusansb.zView file

•path = dist/cli/wp-[redacted].z kind = high_entropy_blob sizeBytes = 347269 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/cli/wp-files/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavusansb.zView on unpkg

dist/cli/wp-files/latest/wordpress/wp-includes/js/dist/editor.jsView file

•path = dist/cli/wp-files/latest/wordpress/wp-includes/js/dist/editor.js kind = oversized_source_file sizeBytes = 2617702 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli/wp-files/latest/wordpress/wp-includes/js/dist/editor.jsView on unpkg

dist/cli/config-BRpv2qyH.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/config-BRpv2qyH.mjsView on unpkg

dist/cli/wp-files/phpmyadmin/js/vendor/zxcvbn-ts.jsView file

1917patternName = generic_password severity = medium line = 1917 matchedText = // risky...ble"

Medium

Secret Pattern

Hardcoded password in dist/cli/wp-files/phpmyadmin/js/vendor/zxcvbn-ts.js

dist/cli/wp-files/phpmyadmin/js/vendor/zxcvbn-ts.jsView on unpkg · L1917

dist/cli/wp-files/latest/wordpress/wp-admin/js/auth-app.min.jsView file

2patternName = generic_password severity = medium line = 2 matchedText = !functio...pp);

Medium

Secret Pattern

Hardcoded password in dist/cli/wp-files/latest/wordpress/wp-admin/js/auth-app.min.js

dist/cli/wp-files/latest/wordpress/wp-admin/js/auth-app.min.jsView on unpkg · L2

Findings

3 High9 Medium10 Low

HighShips High Entropy Blobdist/cli/wp-files/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavusansb.z

HighOversized Source Filedist/cli/wp-files/latest/wordpress/wp-includes/js/dist/editor.js

HighPrevious Version Dangerous Deltadist/cli/config-BRpv2qyH.mjs

MediumSecret Patterndist/cli/wp-files/latest/wordpress/wp-admin/js/auth-app.js

MediumDynamic Requiredist/cli/wp-files/phpmyadmin/js/dist/ol.js

MediumUnsafe Vm Contextdist/cli/data-liberation-agent/dist/lib/replicate/local-data/scaffold-model.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/cli/wp-files/phpmyadmin/js/vendor/zxcvbn-ts.js

MediumSecret Patterndist/cli/wp-files/latest/wordpress/wp-admin/js/auth-app.min.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/cli/wp-files/phpmyadmin/js/dist/functions.js

LowWeak Cryptodist/cli/data-liberation-agent/dist/lib/replicate/parity/parity-classify.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowCopyleft License

Source & flagged code

10 flagged

dist/cli/wp-files/latest/wordpress/wp-admin/js/auth-app.jsView file

Lines 64-104javascript

64 *

65 * In most cases, this should be used in combination with the {@see 'wp_authorize_application_password_form_approved_no_js'}

66 * action to ensure that both the JS and no-JS variants are handled.

67 *

68 * @since 5.6.0

69 *

70 * @param {Object} response The response from the REST API.

71 * @param {string} response.password The newly created password.

72 * @param {string} textStatus The status of the request.

73 * @param {jqXHR} jqXHR The underlying jqXHR object that made the request.

74 */

75 wp.hooks.doAction( 'wp_application_passwords_approve_app_request_success', response, textStatus, jqXHR );

77 var raw = authApp.success,

78 url, message, $notice;

80 if ( raw ) {

81 url = raw + ( -1 === raw.indexOf( '?' ) ? '?' : '&' ) +

82 'site_url=' + encodeURIComponent( authApp.site_url ) +

83 '&user_login=' + encodeURIComponent( authApp.user_login ) +

84 '&password=' + encodeURIComponent( response.password );

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/cli/wp-files/latest/wordpress/wp-admin/js/auth-app.jsView on unpkg · L84

86 window.location = url;

87 } else {

88 message = wp.i18n.sprintf(

89 /* translators: %s: Application name. */

90 '<label for="new-application-password-value">' + wp.i18n.__( 'Your new password for %s is:' ) + '</label>',

91 '<strong></strong>'

92 ) + ' <input id="new-application-password-value" type="text" class="code" readonly="readonly" value="" />';

93 $notice = $( '<div></div>' )

94 .attr( 'role', 'alert' )

95 .attr( 'tabindex', -1 )

96 .addClass( 'notice notice-success notice-alt' )

97 .append( $( '<p></p>' ).addClass( 'application-password-display' ).html( message ) )

98 .append( '<p>' + wp.i18n.__( 'Be sure to save this in a safe location. You will not be able to retrieve it.' ) + '</p>' );

100 // We're using .text() to write the variables to avoid any chance of XSS.

101 $( 'strong', $notice ).text( response.name );

102 $( 'input', $notice ).val( response.password );

103

104 $form.replaceWith( $notice );

dist/cli/wp-files/phpmyadmin/js/dist/functions.jsView file

Lines 3438-3478javascript

3438 addClass = 'off';

3439 } else {

3440 if (right === 'right') {

3441 operator = '+=';

3442 } else {

3443 operator = '-=';

dist/cli/wp-files/phpmyadmin/js/dist/ol.jsView file

Lines 1-26javascript

1"use strict";

3Object.defineProperty(exports, "__esModule", {

4 value: true

5});

6exports.default = void 0;

7var _control = require("ol/control.js"

dist/cli/data-liberation-agent/dist/lib/replicate/local-data/scaffold-model.jsView file

Lines 1-21javascript

1import { runInNewContext } from 'node:vm';

2import { DATA_MODEL_SCHEMA } from './types.js';

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/cli/data-liberation-agent/dist/lib/replicate/local-data/scaffold-model.jsView on unpkg · L1

3import { validateDataModel } from './validate-model.js';

4import { discoverHtmlCards }

dist/cli/data-liberation-agent/dist/lib/replicate/parity/parity-classify.jsView file

Lines 1-21javascript

1// src/lib/replicate/parity/parity-classify.ts

2//

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/data-liberation-agent/dist/lib/replicate/parity/parity-classify.jsView on unpkg · L1

3// The divergence catalog as code — the deterministic heart of the repair

4// loop. Ordered rules; first match wins; anything not provably patchable is

5// REPORTED, never guessed (determinism directive: AI/manual is a separate,

6// opt-in escalation). Patch css is byte-stable: sorted, marker-wrapped, no

7// timestamps.

8//

dist/cli/wp-files/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavusansb.zView file

•path = dist/cli/wp-[redacted].z kind = high_entropy_blob sizeBytes = 347269 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/cli/wp-files/phpmyadmin/vendor/tecnickcom/tcpdf/fonts/dejavusansb.zView on unpkg

dist/cli/wp-files/latest/wordpress/wp-includes/js/dist/editor.jsView file

•path = dist/cli/wp-files/latest/wordpress/wp-includes/js/dist/editor.js kind = oversized_source_file sizeBytes = 2617702 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli/wp-files/latest/wordpress/wp-includes/js/dist/editor.jsView on unpkg

dist/cli/config-BRpv2qyH.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/config-BRpv2qyH.mjsView on unpkg

dist/cli/wp-files/phpmyadmin/js/vendor/zxcvbn-ts.jsView file

Lines 1897-1937javascript

1897 };

1898 const crackTimesDisplay = {

1899 onlineThrottling100PerHour: '',

1900 onlineNoThrottling10PerSecond: '',

1901 offlineSlowHashing1e4PerSecond: '',

1902 offlineFastHashing1e10PerSecond: ''

1903 };

1904 Object.

dist/cli/wp-files/latest/wordpress/wp-admin/js/auth-app.min.jsView file

Lines 1-2javascript

1/*! This file is auto-generated */

2!function(t,s){var p=t("#app_name"),r=t("#approve"),e=t("#reject"),n=p.closest("form"),i={userLogin:s.user_login,successUrl:s.success,rejectUrl:s.reject};r.on("click",